Risk Capital Management

Risk Assets and Risk Buffer

We introduced Risk Capital Management in FYE 2000, when we were carrying large amounts of interest-bearing debt and inefficient assets, making far-reaching management reforms a matter of urgency. Since then, we have pressed forward with that spirit and understand risk quantitatively, and conduct control continuously and rigorously even now that our financial position has improved. Specifically, our basic operational policy involves first calculating risk assets based on the maximum amount of possible future losses from all assets on the balance sheet including investments and all off-balance-sheet transactions. Second, we manage the quantity of risk assets within the limits of our risk buffer (consolidated shareholders' equity + non-controlling interests). As we promote investment in new and next-generation technologies moving forward, we will work to maintain risk assets within the limits of our risk buffer, conduct strict risk management, and further strengthen our financial position.

Country Risk Management

The ITOCHU Group is actively expanding its business in countries and regions overseas and is therefore exposed to various country risks that arise as a result of political, economic, or societal circumstances in those countries and regions. Managing country risk is extremely important because negative factors, such as delay or inhibition of debt collection or operational implementation, can occur all at once and cause large losses.
To respond to these risks, we formulate appropriate risk countermeasures for each individual project and evaluate and analyze risk tolerance. We also establish Groupwide country risk management regulations from the standpoint of preventing excessive concentration of risk in specific countries or regions. Additionally, we work toward risk management by setting limits for each country that are based on internal country rating standards and maintain overall exposure at a level that is appropriate for the Group's financial strength.
Furthermore, we assign exposure limits to countries independent of deliberation processes concerning individual projects and conduct strict country risk management through measures such as not allowing related projects to proceed when country limits have not been assigned.
Additionally, we proactively work to reduce risk by formulating credit policies appropriate for each country according to need and stationing country risk management officials at each Division Company who collaborate with headquarters and manage risk for those Companies.

Security Risk Management

In the past, our computers were infected with malware (malicious software), resulting in an external leak of client information. We have since focused on countermeasures aimed at preventing this from reoccurring. We have strengthened these preventative countermeasures by expanding security infrastructure for monitoring and defense, drastically revising the structure of our cybersecurity countermeasures team (ITCCERT: ITOCHU Computer Emergency Readiness, Response & Recovery Team), and hiring expert advanced cybersecurity analysts.
We routinely collect the latest information regarding threats through analysis of system logs and malware and conduct preventative measures. Additionally, when accidents (incidents) do occur, we respond instantly by investigating their causes, discussing possible countermeasures, and restoring services. In FYE 2018, we established an exclusive space for ITCCERT within our IT Planning Division and are working to strengthen security countermeasures across the entire Group and develop security countermeasure personnel. We also dispatch analysts to Chiba University under cross-appointment contracts (mixed-wage systems) in an effort to train and develop the cybersecurity countermeasure technicians that society needs. There are few examples of user companies in Japan that are working as actively as we are to develop systems and respond to information security risk. We plan to proceed with initiatives supporting sustained growth moving forward.

We periodically tackle the efforts below to maintain and improve the information management structure for information security education.

• We give training to all employees on measures against targeted e-mail attacks, a type of cyber-attack, twice a year.
• We simultaneously hold information security courses through e-learning with all employees and group companies in Japan and overseas every three years.
• We hold information security workshops and lectures for our group companies with ITCCERT serving as the lecturer several times a year.